Visual Decision Mapping - TealTiger Docs

A simplified visual model of how TealTiger maps any agent request to a deterministic governance decision.

Decision Flow (Simplified)

Step	What Happens	Possible Outcome
1. Request arrives	`engine.evaluate(request, ctx)`	—
2. FREEZE check	Match against immutable rules	→ DENY (`FREEZE_BLOCK`) or continue
3. Identity check	Verify NHI status, scope, attestation	→ DENY (`NHI_*`) or continue
4. Temporal check	Session TTL, cooldowns, time-of-day	→ DENY (`SESSION_TTL_EXPIRED`) or continue
5. Module evaluation	All modules run in parallel	Each returns action + reason codes
6. Merge	Most restrictive action wins	Single merged action
7. Automation level	Apply per-rule automation	→ ALLOW / DENY / MODIFY / PENDING
8. Evidence emission	TealProof, SIEM, OTel (async)	Non-blocking

Decision Mapping Table

Given a request, here’s how different scenarios map to decisions:

Scenario	Pre-Eval	Module	Automation	Final Decision
Normal read operation	✅ Pass	✅ ALLOW	auto_allow	ALLOW
Action matches FREEZE rule	❌ FREEZE	— (skipped)	—	DENY (FREEZE_BLOCK)
Agent identity revoked	❌ NHI	— (skipped)	—	DENY (NHI_REVOKED)
PII detected in content	✅ Pass	REDACT	auto_sanitize	MODIFY (sanitized)
Secret in output	✅ Pass	DENY	auto_deny	DENY (SECRET_DETECTED)
High-value payment	✅ Pass	ALLOW	approval_required	PENDING (held for human)
Cost budget exceeded	✅ Pass	DENY	auto_deny	DENY (COST_BUDGET_EXCEEDED)
Behavioral drift detected	✅ Pass	REQUIRE_APPROVAL	approval_required	PENDING (escalated)
Session expired	❌ Temporal	— (skipped)	—	DENY (SESSION_TTL_EXPIRED)
Module crashes (fail-closed)	✅ Pass	ERROR	—	DENY (fail-closed default)

Key Properties

Property	Guarantee
Deterministic	Same request + same policy = same decision (always)
Short-circuit	Pre-evaluation failures skip modules entirely (fastest DENY path)
Parallel	Modules don’t wait for each other
Most restrictive	One DENY overrides all ALLOWs
Non-blocking evidence	Decision returned before evidence is fully emitted
Fail-closed	Unknown states → DENY (never allow ungoverned)

Evaluation Flow

Detailed 3-stage pipeline with SVG diagram

Enforcement Flow

How modes and automation levels interact